Hi All,
I have a question.
Imagine an architecture of two indexer and a universal forwarder that send data in load balancing mode toward them.
The indexers are configured to store data into a volume shared and the indexes.conf has the index configured with the same path.
Example "indexes.conf" for both indexer:
[volume:test1]
path = /mnt/test1_volume
[test_idx]
homePath = $SPLUNK_DB/test_idx/db
coldPath = volume:test1/test_idx/colddb
thawedPath = $SPLUNK_DB/test_idx/thaweddb
...
...
Now, We know that every bucket has the following synopsis db_youngest_oldest_ID , where ID is used by splunk to check conflict.
What happen when every indexer manage own data and create the same bucket ID into the share cold path?
Is Splunk Enterprise smart enough to prevent conflicts and handle two identical IDs?
Maybe the solution with less risk is to create two volume export into the storage and every indexer has the own storage location but I am curious to know the behaviour of splunk (maybe it overwrite bucket data) .
Regards,
Antonio
↧